Data protection in inter agency sharing

Introduction

Inter-agency data sharing refers to the exchange of information between government departments, regulatory authorities, research institutions, healthcare organisations, and other public or private agencies for administrative, scientific, regulatory, or public welfare purposes. In biotechnology and healthcare, such sharing may involve patient records, genetic information, clinical trial results, disease surveillance data, and biological research records.

Although inter-agency sharing can improve scientific research, public health monitoring, and regulatory coordination, it also creates risks of unauthorised disclosure, excessive data collection, misuse, and privacy violations. Therefore, agencies must follow appropriate legal safeguards while exchanging personal and sensitive information.

Legal framework in India

1. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It regulates Data Fiduciaries and their responsibilities when personal information is collected, stored, used, or shared.

Section 4 establishes the requirement for processing personal data for a lawful purpose, subject to the Act. Section 8 provides obligations relating to processing, security safeguards, and accountability. Section 7 recognises certain legitimate uses, including specified circumstances involving the State and its instrumentalities.

Government agencies cannot assume that every exchange of information is automatically lawful. They must identify the applicable legal basis, purpose, and statutory conditions. The Act's commencement notifications and applicable rules must also be considered when determining which provisions are operational.

2. Information Technology Act, 2000

The Information Technology Act provides additional legal safeguards concerning electronic information. Section 72 addresses breach of confidentiality and privacy by persons who obtain access under powers conferred by the Act. Section 70 provides for the protection of designated protected systems, while Section 70B establishes CERT-In as the national agency for cybersecurity incident response.

These provisions are relevant when agencies exchange information through government databases, electronic records, and digital infrastructure.

3. Right to Information Act, 2005

Section 8(1)(j) of the Right to Information Act protects certain personal information from disclosure, subject to the statutory public-interest framework. The provision was amended by the Digital Personal Data Protection Act, 2023, so its current wording and commencement must be considered when applying it.

The law demonstrates that transparency in government administration must be balanced against individual privacy.

International legal framework

The European Union's General Data Protection Regulation (GDPR) provides important standards for inter-agency data sharing. Article 5 establishes principles such as purpose limitation, data minimisation, accuracy, and storage limitation. Article 6 requires a lawful basis for processing, while Article 32 requires appropriate security measures.

The OECD Privacy Guidelines also promote accountability, transparency, security safeguards, and limits on the collection and use of personal information.

In biotechnology research, these principles are particularly important when health authorities, universities, laboratories, and regulatory bodies exchange genetic or clinical information across national borders.

Important safeguards for inter-agency data sharing

Agencies should establish clear procedures before exchanging personal information. These safeguards should include:

Lawful purpose: Information must be shared for a legally authorised and clearly defined purpose.

Data minimisation: Only information necessary for the stated purpose should be disclosed.

Access control: Access should be restricted to authorised officials and researchers.

Confidentiality agreements: Agencies should establish responsibilities through written agreements.

Security measures: Encryption, authentication, secure storage, and access monitoring should be implemented.

Retention limits: Information should not be retained indefinitely without legal justification.

Audit mechanisms: Records of access, transfers, and disclosures should be maintained.

Breach response: Agencies should establish procedures for reporting and investigating unauthorised access.

For example, if a public health department shares patient information with a biotechnology research institution, the agreement should specify the research purpose, permitted users, security requirements, retention period, and restrictions on further disclosure.

Relevant case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21. The judgment established that the collection and sharing of personal information by public authorities must satisfy constitutional requirements, including legality, legitimate purpose, and proportionality. It is a foundational authority for protecting personal information during inter-agency sharing.

2. District Registrar and Collector, Hyderabad v. Canara Bank (2005)

The Supreme Court emphasised the importance of privacy and confidentiality in personal and financial records. The decision supports the principle that public authorities cannot disregard confidentiality when obtaining or disclosing private information.

3. K.S. Puttaswamy v. Union of India (Aadhaar case) (2018)

The Supreme Court examined the constitutional validity of the Aadhaar framework and addressed the use and sharing of identity information. The judgment emphasised proportionality, purpose limitation, and safeguards against unnecessary disclosure of personal information.

4. State of Uttar Pradesh v. Raj Narain (1975)

The Supreme Court considered the relationship between government confidentiality and the public's right to know. Although the case primarily concerned disclosure of official documents, it provides an important principle for balancing transparency and legitimate confidentiality interests in public administration.

These decisions do not directly prescribe a complete inter-agency data-sharing framework. They provide constitutional and legal principles that guide the responsible exchange of information.

Challenges in inter-agency data sharing

Inter-agency sharing may create difficulties when different organisations follow inconsistent security standards or maintain incompatible databases. Other concerns include unauthorised access, unclear responsibility for data breaches, excessive information collection, and transfers without adequate legal authority.

In biotechnology, additional concerns arise because genetic and clinical information may reveal sensitive details about individuals and their biological relatives. Agencies must therefore consider privacy, informed consent where required, confidentiality, and restrictions on secondary use.

Conclusion

Data protection in inter-agency sharing is essential for maintaining public trust, protecting individual privacy, and ensuring responsible government administration. Indian constitutional principles, the DPDP Act, 2023, the Information Technology Act, 2000, and international privacy standards provide the legal foundation for regulating information exchange. Agencies should adopt clear agreements, lawful-purpose restrictions, security safeguards, access controls, and accountability mechanisms. These measures are particularly important in healthcare and biotechnology, where improper disclosure of genetic and medical information may have serious consequences.